Electrical apparatus for the detection and measurement of

BS EN 50402:2017

Electrical apparatus for thedetection and measurementof combustible or toxic gasesor vapours or of oxygen —Requirements on the functionalsafety of gas detection systems

BSI Standards Publication

WB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06

This is a preview of "BS EN 50402:2017". Click here to purchase the full version from the ANSI store.

https://webstore.ansi.org/Standards/BSI/BSEN504022017?source=preview

BS EN 50402:2017 BRITISH STANDARD

National foreword

This British Standard is the UK implementation of EN 50402:2017. It supersedes BS EN 50402:2005+A1:2008 which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee EXL/31/1, Gas detectors.

A list of organizations represented on this committee can be obtained on request to its secretary.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

© The British Standards Institution 2017.Published by BSI Standards Limited 2017

ISBN 978 0 580 91961 9

ICS 13.320

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 March 2017.

Amendments/corrigenda issued since publication

Date Text affected



BS EN 50402:2017

EUROPEAN STANDARD

NORME EUROPÉENNE

EUROPÄISCHE NORM

EN 50402

March 2017

ICS 13.320 Supersedes EN 50402:2005

English Version

Electrical apparatus for the detection and measurement of combustible or toxic gases or vapours or of oxygen -

Requirements on the functional safety of gas detection systems

Matériel électrique pour la détection et la mesure des gaz ou vapeurs combustibles ou toxiques, ou de l'oxygène -

Exigences relatives à la fonction de sécurité des systèmes de détection de gaz

Elektrische Geräte für die Detektion und Messung von brennbaren oder toxischen Gasen und Dämpfen oder

Sauerstoff - Anforderungen an die funktionale Sicherheit von Gaswarnsystemen

This European Standard was approved by CENELEC on 2017-02-04. CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom.

European Committee for Electrotechnical Standardization Comité Européen de Normalisation Electrotechnique

Europäisches Komitee für Elektrotechnische Normung

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels

© 2017 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.

Ref. No. EN 50402:2017 E



BS EN 50402:2017

Contents Page European foreword ............................................................................................................................................. 7

Introduction ......................................................................................................................................................... 8

1 Scope .................................................................................................................................................... 10

2 Normative references .......................................................................................................................... 11 3 Terms and definitions ......................................................................................................................... 12

4 General requirements ......................................................................................................................... 17 4.1 Specification of safety functions ....................................................................................................... 17 4.2 Determination of safety function ....................................................................................................... 23 4.3 Functional safety characteristics of modules .................................................................................. 24

5 Functional modules and elements — Characterization and requirements ................................... 25 5.1 General ................................................................................................................................................. 25 5.1.1 Structure of functional modules ........................................................................................................ 25 5.1.2 General requirements ......................................................................................................................... 29 5.2 Gas sampling ....................................................................................................................................... 30 5.2.1 Gas aspiration ...................................................................................................................................... 30 5.2.2 Conditioning of measured gas ........................................................................................................... 30 5.2.3 Gas multiplexer .................................................................................................................................... 31 5.2.4 Gas sampling by diffusion mode ....................................................................................................... 31 5.2.5 Automatic calibration and adjustment .............................................................................................. 31 5.3 Sensor .................................................................................................................................................. 32 5.4 Signal-transmission ............................................................................................................................ 33 5.4.1 General requirements ......................................................................................................................... 33 5.4.2 Signal-transmission between spatially separated modules ........................................................... 33 5.4.3 Signal-transmission between modules not spatially separated .................................................... 35 5.5 Input to signal processing .................................................................................................................. 36 5.5.1 General ................................................................................................................................................. 36 5.5.2 Interface for measured signal ............................................................................................................ 36 5.5.3 Input system communication ............................................................................................................. 36 5.5.4 User interface ....................................................................................................................................... 36 5.5.5 Input from periphery ........................................................................................................................... 37 5.5.6 Power supply ....................................................................................................................................... 37 5.6 Signal processing ................................................................................................................................ 37 5.6.1 General ................................................................................................................................................. 37 5.6.2 Calculation of measured values ........................................................................................................ 39 5.6.3 Special state ......................................................................................................................................... 39 5.6.4 Signal assessment .............................................................................................................................. 40 5.6.5 Diagnostic means within a control unit ............................................................................................ 41 5.6.6 Reduced mode of operation ............................................................................................................... 43 5.6.7 Aspiration control ................................................................................................................................ 44 5.6.8 Gas multiplexer control ...................................................................................................................... 44 5.6.9 Control of automatic calibration ........................................................................................................ 44 5.6.10 Control of automatic adjustment ....................................................................................................... 45 5.7 Output of the control ........................................................................................................................... 45 5.7.1 Visual indication .................................................................................................................................. 45 5.7.2 Switching output ................................................................................................................................. 46 5.7.3 Output system communication .......................................................................................................... 47 5.7.4 Output to periphery ............................................................................................................................. 48 5.7.5 Data archives ....................................................................................................................................... 48

6 Software ............................................................................................................................................... 49 6.1 General requirements ......................................................................................................................... 49 6.2 Context of the Software Standard ..................................................................................................... 49 6.3 Requirements from EN 61508-3 ......................................................................................................... 49

EN 50402:2017 (E)



BS EN 50402:2017EN 50402:2017 (E)

3

6.4 List of replaced or not relevant clauses in EN 61508-3:2010 .......................................................... 50 6.5 List of changes to clauses in EN 61508-3 ......................................................................................... 51 6.6 EN 50402 Levels of rigour .................................................................................................................. 54 6.7 Tables of techniques and measures from EN 61508-3:2010, Annex A .......................................... 55 6.7.1 Explanation of terms ........................................................................................................................... 55 6.7.2 Writing conventions in the tables of techniques and measures .................................................... 55 6.7.3 Software requirements specification ................................................................................................ 55 6.7.4 Software architecture design ............................................................................................................. 58 6.7.5 Software design and development – Support tools and programming language ........................ 62 6.7.6 Software detailed design .................................................................................................................... 62 6.7.7 Software module testing and integration.......................................................................................... 65 6.7.8 PE integration (hardware + software) ................................................................................................ 67 6.7.9 Software validation .............................................................................................................................. 68 6.7.10 Modification ......................................................................................................................................... 69 6.7.11 Software Verification ........................................................................................................................... 70 7 Combining Functional Modules to Safety Functions ...................................................................... 72 7.1 SIL-capability ....................................................................................................................................... 72 7.2 Determination of SIL-capabilities for a safety function ................................................................... 73 7.2.1 General ................................................................................................................................................. 73 7.2.2 Summarizing of single chains ............................................................................................................ 74 7.2.3 Summarizing of parallel chains ......................................................................................................... 74 8 Determination of hardware failure rates for each safety function ................................................. 75

9 Gas detection as part of an overall safety function ......................................................................... 76

10 Information requirements ................................................................................................................... 77

11 Validation ............................................................................................................................................. 78

12 Functional safety management .......................................................................................................... 79

13 Functional safety assessment ........................................................................................................... 79 14 Documentation .................................................................................................................................... 79

Annex A (normative) Transformation of the SIL-capabilities of gas detection systems ......................... 80

A.1 Introduction .......................................................................................................................................... 80

A.2 Transformation of the SIL-capabilities of gas detection systems to the safety integrity levels of EN 61508 (all parts) .............................................................................................................. 80

Annex B (normative) Transformation from generic standard requirements to modules ........................ 81 B.1 General ................................................................................................................................................. 81

B.2 SIL-capability 1 .................................................................................................................................... 81

B.3 SIL-capability 2 .................................................................................................................................... 81

B.4 SIL-capability 3 .................................................................................................................................... 82

Annex C (informative) Determination of SIL-capability of a safety function of the gas detection system .................................................................................................................................................. 83

C.1 General ................................................................................................................................................. 83

C.2 Procedure of determination of SIL-capability .................................................................................. 83

C.3 Example: Determination of SIL-capability for a gas detection system .......................................... 89

C.3.1 General ................................................................................................................................................. 89

C.3.2 Example: Characterization of relay outputs of control units A and B ........................................... 89

C.3.3 Example: Characterization of relay output of common alarm ........................................................ 91 Annex D (informative) Failure modes for specific measuring principles .................................................. 93



BS EN 50402:2017

D.1 Introduction .......................................................................................................................................... 93

D.2 Failure modes relevant to most or all types of measuring principles and types of sensing elements ............................................................................................................................................... 93

D.2.1 Generic failure modes ......................................................................................................................... 93

D.2.2 Failure modes identified in the metrological standards.................................................................. 93

D.3 Catalytic sensing elements ................................................................................................................ 94

D.4 Thermal conductivity sensing elements ........................................................................................... 94

D.5 Infrared sensing elements .................................................................................................................. 94

D.5.1 Point detectors .................................................................................................................................... 94 D.5.2 Open path detectors ............................................................................................................................ 95

D.5.3 TDLAS (e.g. for oxygen)...................................................................................................................... 95

D.6 Semiconductor sensing elements ..................................................................................................... 95

D.7 Electrochemical sensing elements .................................................................................................... 95

D.7.1 Galvanic — Lead based oxygen ........................................................................................................ 95

D.7.2 Amperometric with organic or aqueous electrolyte ........................................................................ 96 D.8 FID sensing elements.......................................................................................................................... 96

D.9 FTA sensing elements ........................................................................................................................ 96

D.10 Paramagnetic sensing elements ........................................................................................................ 97

D.10.1 General ................................................................................................................................................. 97

D.10.2 Principle using a dumbbell ................................................................................................................. 97

D.10.3 Microflow Measuring Principle .......................................................................................................... 97 D.10.4 Measurement of magnetic susceptibility .......................................................................................... 98

D.10.5 Paramagnetic thermal effect .............................................................................................................. 98

D.11 PID sensing elements ......................................................................................................................... 98

Figures

Figure 1 — Definitions of measuring point, measuring group and measuring location........................... 14

Figure 2a — Gas detection system plus actuator for safety function ........................................................ 18 Figure 2b — Gas detection system plus actuator for safety function ........................................................ 19

Figure 2c — Gas detector with relay output plus actuator for safety function .......................................... 20

Figure 2d — Gas detection system plus actuator for safety function ........................................................ 20

Figure 2e — Gas detection system plus actuator for safety function ........................................................ 21

Figure 2f — Gas detection system plus actuator for safety function ......................................................... 22

Figure 2 — Examples for the overall safety function of gas detection systems ....................................... 22 Figure 3 — Overview of safety-related system ............................................................................................. 26

Figure 4 — Modules of a gas detection system ............................................................................................ 28

Figure 5 — Architectures for data communication ....................................................................................... 35

Figure 6 — Single and parallel chains ............................................................................................................ 73

Figure 7 — Handling of complex modules in a redundant structure .......................................................... 75

EN 50402:2017 (E)



BS EN 50402:2017EN 50402:2017 (E)

5

Figure C.1 — Step 1 – Linkage of modules.................................................................................................... 83

Figure C.2 — Step 2 – Identification of modules necessary for the safety function ................................. 84

Figure C.3 — Step 3 – Elimination of modules and linkages without influence on the safety function ................................................................................................................................................ 84

Figure C.4 — Step 4 (1st loop) – Summarizing of single chains ................................................................. 84

Figure C.5 — Step 5 (1st loop) – Summarizing of parallel chains ............................................................... 85

Figure C.6 — Step 6 (1st loop) – Adaptation of block diagram structure ................................................... 87

Figure C.7 — Step 4 (2nd loop) – Summarizing of single chains ................................................................ 87

Figure C.8 — Step 5 (2nd loop) – Summarizing of parallel chains .............................................................. 87 Figure C.9 — Step 6 (2nd loop) – Adaptation of block diagram structure – No action required ............. 88

Figure C.10 — Step 4 (3rd loop) – Summarizing of single chains ............................................................... 88

Figure C.11 — Step 5 (3rd loop) – Summarizing of parallel chains ............................................................ 88

Figure C.12 — Step 6 (3rd loop) – Adaptation of block diagram structure – No action required ............ 88

Figure C.13 — Step 4 (4th loop) – Summarizing of single chains – End of procedure ............................. 89

Figure C.14 — Step 1 – Linkages between modules for the example ......................................................... 89 Figure C.15 — Step 2 – Identification of modules with influence on the safety function ......................... 90

Figure C.16 — Step 3 – Elimination of modules and linkages without influence on the safety function ................................................................................................................................................ 90

Figure C.17 — Step 4 – Summarizing of single chains ................................................................................ 90

Figure C.18 — Step 5 – Summarizing of parallel chains – End of procedure ............................................ 90

Figure C.19 — Step 2 – Identification of modules with influence on the safety function ......................... 91 Figure C.20 — Step 3 – Elimination of modules and linkages without influence on the safety

function ................................................................................................................................................ 91

Figure C.21 — Step 4 (1st loop) – Summarizing of single chains ............................................................... 92

Figure C.22 — Step 5 (1st loop) – Summarizing of parallel chains ............................................................. 92

Figure C.23 — Step 6 (1st loop) – Adaptation of block diagram structure – No action required ............. 92

Figure C.24 — Step 4 (2nd loop) – Summarizing of single chains – End of procedure ............................ 92 Tables

Table 1 — Fault tolerance for simple modules according to EN 61508–2:2010, (Table 2) ........................ 24

Table 2 — Fault tolerance for complex modules according to EN 61508–2:2010, (Table 3) .................... 25

Table 3 — Diagnostic measures for program sequence monitoring and clock from EN 61508–2 .......... 41

Table 4 — Diagnostic measures for memory from EN 61508–2 .................................................................. 42

Table 5 — List of replaced or not relevant clauses in EN 61508–3:2010 .................................................... 50 Table 6 — List of changes to clauses in EN 61508–3:2010 .......................................................................... 51

Table 7 — EN 50402 levels of rigour ............................................................................................................... 54

Table 8 — EN 50402 software requirements specification (from EN 61508–3:2010, Table A.1) ............... 55

Table 9 — Semi formal and formal methods (from EN 61508–3:2010, Table B.7) as applied to Table A.1 ............................................................................................................................................... 57

Table 10 — EN 50402 software architecture design (from EN 61508–3:2010, Table A.2) ......................... 58 Table 11 — EN 50402 software design (from EN 61508–3:2010, Table A.3) ............................................... 62

Table 12 — EN 50402 software detailed design (from EN 61508–3:2010, Table A.4) ................................ 62



BS EN 50402:2017

Table 13 — Semi-formal methods (EN 61508–3:2010, Table B.7) as applied to Table A.4 ....................... 64

Table 14 — EN 50402 software module testing and integration (from EN 61508–3:2010, Table A.5) ...... 65

Table 15 — EN 50402 PE integration (hardware + software) (from EN 61508–3:2010, Table A.6) ........... 67 Table 16 — EN 50402 software validation (from EN 61508–3:2010, Table A.7) .......................................... 68

Table 17 — EN 50402 modification (from EN 61508–3:2010, Table A.8) ..................................................... 69

Table 18 — EN 50402 software verification (from EN 61508–3:2010, Table A.9) ....................................... 70

Table 19 — For low demand mode of operation (see EN 61508–1:2010, 7.6.2.9, Table 2) ........................ 76

Table 20 — For high demand mode of operation or continuous mode of operation (see EN 61508–1:2010, 7.6.2.9, Table 3) ............................................................................................ 76

Table A.1 — Transformation of the SIL-capabilities of EN 50402 to SIL of EN 61508 (all parts) .............. 80

Table C.1 — Determination of SIL-capability for a parallel chain block (applicable for hardware only) ...................................................................................................................................................... 86

EN 50402:2017 (E)



BS EN 50402:2017EN 50402:2017 (E)

7

European foreword

This document (EN 50402:2017) has been prepared by CLC/SC 31-9 “Electrical apparatus for the detection and measurement of combustible gases to be used in industrial and commercial potentially explosive atmospheres” of CLC/TC 31 “Electrical apparatus for potentially explosive atmospheres” and by CLC/TC 216 “Gas detectors”.

The following dates are fixed:

• latest date by which this document has to be implemented at national level by publication of an identical national standard or by endorsement

(dop) 2018-02-04

• latest date by which the national standards conflicting with this document have to be withdrawn

(dow) 2020-02-04

This document supersedes EN 50402:2005.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.

EN 50402:2017 includes the following significant technical changes with respect to EN 50402:2005:

— In general, the standard is updated to consider the modifications in the second edition of EN 61508 for hardware and software. Route 2 of the second edition of EN 61508 will not be permitted for gas detection equipment.

— The standard is updated for the SIL 1 requirements to be in line with the second edition of EN 50271 specifying the minimum requirements for functional safety for performance approved gas detectors, gas detection apparatus and complete gas detection systems.

— The latest revisions of the metrological standards have been considered.

— SIL 4 has been deleted as being not appropriate to gas detection.

— Clauses 4 and 5 have been updated for more detailed specification.

— Clause 6 for software is new.

— Clauses 7 to 11 are restructured for clarification of requirements and relation to EN 61508.

— Clause 10 is specifying more details for the customer information.

— The former normative Annex D is now Clause 12.

— The former informative Annex A has been deleted. Relevant text was moved to Clauses 7 to 9.

— The new informative Annex D is providing information on failure modes of sensing elements.



BS EN 50402:2017

Introduction

This European Standard specifies requirements for the functional safety of gas detection systems. It encompasses criteria for reliability, avoidance of faults and fault tolerance. Functional safety is that part of the overall safety which relates specifically to the measures required within the gas detection system to avoid or to handle failures so that the safety function is ensured. This includes not only design and the development process requirements of the gas detection system but also the information requirements for planning, putting into operation, maintenance and repair.

This European Standard is dedicated to the manufacturer. Information important for the safe use of the device (gas detection system) will be specified in the instruction manual.

Gas detection systems will fail to function if dangerous failures occur in the equipment used. Failure to function will also occur if such systems are not installed or maintained in an appropriate manner. In some applications, failures of this type will dominate the functional safety achieved. This European Standard is only targeted at reducing equipment failures to levels appropriate to the application. Users of gas detection systems will therefore need to ensure installation and maintenance of such systems is carried out according to the instruction manual. This European Standard does not specify the physical positioning of measuring points / locations.

Gas detection systems may differ widely in structure, complexity and performance. They may not be handled in a uniform manner like low complexity devices, for this reason a general specification of requirements is not possible.

Gas detection systems therefore need to be divided into functional modules for validation to ensure that systems which have different structures are handled according to appropriate procedures. A gas detection system will not normally include all the modules covered by this European Standard. Requirements are specified for each of these modules in terms of hierarchical levels which represent one of the constituents of functional safety performance. The hierarchical levels are termed as SIL-capabilities, with SIL-capability 1 representing the minimum and SIL-capability 3 the maximum levels of functional safety to comply with this European Standard. The SIL-capability of a module is related to the maximum safety integrity level that may be claimed for a safety function which uses modules of that specified SIL-capability. Modules will be characterized in terms of their SIL-capability. Information is also required on failure rate characteristics of modules or related physical components to enable the manufacturer to determine the overall level of functional safety of a gas detection system. In this way, the manufacturer will take account of both random failures of hardware components and systematic failures in hardware and software. This European Standard also specifies the requirements that will enable determination of whether the gas detection system has a low enough failure rate when used in conjunction with other equipment necessary for functional safety.

This European Standard will enable the functional safety characteristics of the gas detection system to be determined from the characteristics of its modules and components (see Annex C). This will enable a gas detection system to be used as a part of an overall safety system. The characterization including the determination of a SIL-capability and failure rate data will only need to be carried out once for a particular module or component.

Depending on characterization of each module and component, the properties of each chosen safety function of the whole gas detection system will be specified. The procedure for determining the SIL-capability of a safety function of a gas detection system will only need to be repeated for each new combination of modules and components. Different combinations of equivalent modules may lead to gas detection systems which reach different SIL-capabilities.

In this way a flexible adoption of the gas detection system into different applications will be possible without repeating all steps of the validation procedure for every new configuration.

EN 50402:2017 (E)



BS EN 50402:2017EN 50402:2017 (E)

9

This European Standard does not include requirements for availability which will need to be considered separately.

This European Standard is dedicated to manufacturers and is applicable to gas detection systems or parts of them (e.g. gas detection transmitters or gas detection control units) as basis for functional safety testing. It supplements the requirements of the relevant metrological standards. It should not be confused with EN 60079–29–3 which is dedicated to system integrators to give guidance for combining gas detection apparatus with other equipment (e.g. gas processing, filters, valves) not provided by the gas detection manufacturer but part of a safety function under the responsibility of the system integrator.



BS EN 50402:2017

1 Scope

This European Standard is applicable to detection and measurement apparatus and systems for flammable or toxic gases or vapours or oxygen. It covers apparatus intended to measure reliably, gas concentration and to provide an output signal (alarm and/or measurement signal), the purpose of which is to give a warning of a potential hazard.

This European Standard is a product standard which is based on EN 61508 (all parts) and for gas detection systems covers both low and high demand mode at SIL capabilities of 1, 2 or 3 only. Gas detection apparatus and gas detection systems are developed as generic products. This European Standard covers part of the phase 10 “realization” of the overall safety lifecycle defined in EN 61508-1:2010, Figure 2. Configuration and integration into specific applications is not covered by this European Standard.

In the event of conflict between the requirements of this European Standard and those of EN 61508, EN 50402 will take precedence.

NOTE 1 Applications requiring a SIL capability of 4 for a gas detection system are not practicable.

This European Standard is dedicated mainly to fixed apparatus and systems. However, it can also be applied to transportable gas detectors which are intended to be used as temporary replacements for fixed apparatus.

This European Standard supplements the requirements of the European Standards for electrical apparatus for the detection and measurement of flammable gases, vapours (e.g. EN 60079-29-1 or EN 60079-29-4), toxic gases (e.g. EN 45544) or oxygen (e.g. EN 50104).

NOTE 2 These European Standards are called in the text “metrological standards”.

The examples above show the state of the standardization for industrial applications at the time of publishing this European Standard. There may be other metrological standards covering other application fields, for which this European Standard is also applicable.

EN 50271 specifies minimum requirements for apparatus using software and/or digital components. It also defines additional optional requirements for compliance with SIL 1 in low demand mode operation. EN 50402 includes all requirements of EN 50271.

EN 50402 is also dedicated to apparatus and gas detection systems and/or components and should be used instead of EN 50271 in the following cases:

— at SIL 1 when the system contains components not covered by EN 50271;

— at SIL 1 high demand mode operation;

— at SIL 2 and SIL 3;

— at all SILs when non-digital based apparatus is used.

Applying the above-mentioned metrological standards will ensure the performance is adequate in normal operation of a gas detection system. Additionally, the requirements of this European Standard address the functional safety of gas detection systems and encompass criteria for reliability, fault tolerance and avoidance of systematic failures. The avoidance and control of systematic failures will be covered by the requirements for the development processes and techniques and diagnostic measures chosen in the design. This European Standard will lead to the characterization of the gas detection system by a SIL-capability and related hardware failure rate representing a hierarchical order of safety levels. This will allow the user to incorporate the gas detection system into an overall safety system according to the safety integrity levels of EN 61508 (all parts).

This European Standard is applicable for gas detection systems, which may consist of the following functional units:

— gas-sampling;

— sensor;

EN 50402:2017 (E)



Documents

Electrical apparatus for the detection and measurement of